Do more bounds checking.

[tcpdump] / print-bootp.c

diff --git a/print-bootp.c b/print-bootp.c
index ce1f9c6c8b5b575dfa57313e5dbb36afd04ce058..c0077eeb23dbe30f7e085790ce5442c3d4f2f4ab 100644 (file)
--- a/print-bootp.c
+++ b/print-bootp.c
@@ -21,8 +21,8 @@
  * Format and print bootp packets.
  */
 #ifndef lint
  * Format and print bootp packets.
  */
 #ifndef lint

-static const char rcsid[] =
-    "@(#) $Header: /tcpdump/master/tcpdump/print-bootp.c,v 1.74 2003-07-01 19:16:06 guy Exp $ (LBL)";
+static const char rcsid[] _U_ =
+    "@(#) $Header: /tcpdump/master/tcpdump/print-bootp.c,v 1.78.2.2 2005-05-06 04:19:39 guy Exp $ (LBL)";

 #endif
 
 #ifdef HAVE_CONFIG_H
 #endif
 
 #ifdef HAVE_CONFIG_H


@@ -141,7 +141,7 @@ bootp_print(register const u_char *cp, u_int length)
                }
                putchar('"');
        }
                }
                putchar('"');
        }

-       TCHECK2(bp->bp_sname[0], 1);            /* check first char only */
+       TCHECK2(bp->bp_file[0], 1);             /* check first char only */

        if (*bp->bp_file) {
                printf("\n\t  file \"");
                if (fn_print(bp->bp_file, snapend)) {
        if (*bp->bp_file) {
                printf("\n\t  file \"");
                if (fn_print(bp->bp_file, snapend)) {


@@ -444,7 +444,10 @@ rfc1048_print(register const u_char *bp)
                case 'a':
                        /* ascii strings */
                        putchar('"');
                case 'a':
                        /* ascii strings */
                        putchar('"');

-                       (void)fn_printn(bp, size, NULL);
+                       if (fn_printn(bp, size, snapend)) {
+                               putchar('"');
+                               goto trunc;
+                       }

                        putchar('"');
                        bp += size;
                        size = 0;
                        putchar('"');
                        bp += size;
                        size = 0;


@@ -556,13 +559,21 @@ rfc1048_print(register const u_char *bp)
                                break;
 
                        case TAG_CLIENT_FQDN:
                                break;
 
                        case TAG_CLIENT_FQDN:

+                               /* option 81 should be at least 4 bytes long */
+                               if (len < 4)  {
+                                        printf("ERROR: options 81 len %u < 4 bytes", len);
+                                       break;
+                               }

                                if (*bp++)
                                        printf("[svrreg]");
                                if (*bp)
                                        printf("%u/%u/", *bp, *(bp+1));
                                bp += 2;
                                putchar('"');
                                if (*bp++)
                                        printf("[svrreg]");
                                if (*bp)
                                        printf("%u/%u/", *bp, *(bp+1));
                                bp += 2;
                                putchar('"');

-                               (void)fn_printn(bp, size - 3, NULL);
+                               if (fn_printn(bp, size - 3, snapend)) {
+                                       putchar('"');
+                                       goto trunc;
+                               }

                                putchar('"');
                                bp += size - 3;
                                size = 0;
                                putchar('"');
                                bp += size - 3;
                                size = 0;


@@ -573,7 +584,10 @@ rfc1048_print(register const u_char *bp)
                                size--;
                                if (type == 0) {
                                        putchar('"');
                                size--;
                                if (type == 0) {
                                        putchar('"');

-                                       (void)fn_printn(bp, size, NULL);
+                                       if (fn_printn(bp, size, snapend)) {
+                                               putchar('"');
+                                               goto trunc;
+                                       }

                                        putchar('"');
                                        bp += size;
                                        size = 0;
                                        putchar('"');
                                        bp += size;
                                        size = 0;